The present invention relates to grasping, from network data, information on connection of nodes each of which is a component of a load balancing system configured with a redundant system.
Recently, companies have been constructing many systems for their customers or internal use via the Internet or intranet in order to provide various services. In order to prevent damage due to a loss of business opportunity or suspension of business operation, these systems are generally load balancing systems, in which loads are balanced by each processing, and which are redundant. In particular, in Web systems used in mission-critical business operation, a load balancing apparatus is often used to configure a cluster for the purposes of achievement of high availability and high speed.
In the field of system management or business management, system configuration information is used for analysis of impact of each system component upon a whole system or business. Although a system administrator should grasp the system configuration information, it is difficult to grasp the system configuration information with accuracy and in real time in some cases: where, as time goes by, the system administrator is changed, or the system administrator often comes to have a dim memory of the system configuration information; and where there are many system administrators, when a single company operates many systems for business or customers.
Some of the load balancing systems adopt a MAC (Media Access Control) transfer mode, which involves using a virtual IP (Internet Protocol) address and a MAC address for transfer via a load balancing server, in order that users can unconsciously access the systems.
The load balancing system based on the MAC transfer mode is configured of a load balancing server and one or more cluster nodes, which are installed in the same segment. The load balancing server receives a packet destined for a virtual IP address for use in a cluster, rewrites only Ethernet layer information, and forwards the packet to an Ethernet address (or a MAC address) of a cluster node by use of uniquely set ARP (Address Resolution Protocol table) information. On the other hand, the cluster node is set to receive the packet destined for the virtual IP address. The cluster node recognizes that the packet is received directly from a client, and sends back the packet directly to the client, without passing through the load balancing server.
As a result of automatic detection of the load balancing system based on the MAC transfer mode, however, the load balancing system is recognized as one node having a virtual IP address, whereby it is made impossible to grasp the overall configuration of the load balancing system. In other words, network analysis of IP or higher layers leads to a recognition that packets with the identical contents are overlapping. Even if MAC address information in the packet is used for analysis, it is necessary to analyze by use of knowledge of a correspondence between, in a monitor segment, a physical network structure (a relationship between MAC and IP addresses) and a logical network structure. For example, when two transactions having the identical contents but different MAC addresses are observed, it is required to determine whether this overlap is caused by MAC transfer, or packets on different channels are monitored in an overlapping manner. Additionally, there may be a case of merely retransmitting between communication devices, and thereby it is difficult to determine.
H. Kashima discloses a method for grasping a calling relationship by using transaction information in “Network-based Problem Determination for Distributed Computer Systems,” ICDE 2005. The method disclosed in non-patent document 1 finds the calling relationship, provided that there is a transaction having IP or higher layer information. The method is incapable of finding the system configuration formed of the load balancing system. The method is aimed at solely analysis by using the found configuration information.
In a load balancing system, in order to grasp an overall redundant system for impact analysis, it is needed to acquire information on a connection relationship of load balancing servers and cluster nodes based on the MAC transfer mode.